Security Basics: PHP
For those who are using scripts like Moveable Type and Wordpress, they have little to worry about security since they only need to wait for patches and upgrades. But for those who make their own PHP scripts from scratch, Chris Shifflet outlines some measures and guidelines.
- The
register_globalsdirective is a security risk, so do not rely on it as much - Filter input and sanitize output
- Filter all foreign data
- Filter data using a whitelist approach
- Use existing functions in data filtering
- Use a sctrict naming conventions
- Try placing all modules outside the document root
- Try escaping all characters that can be escaped
For further information, download Shifflet’s PHP Security guide here. You may also want to visit the PHP Security Consortium.
Add comment November 6th, 2008
